CVE-2026-123596 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's validating recursor accepts parent-side NSEC records as proof that names below a zone cut do not exist. An on-path attacker or rogue parent nameserver can send one forged NXDOMAIN, so existing child-zone names are denied and cached for the negative TTL.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only teams running the Hickory validating recursor with DNSSEC validation enabled are exposed; the flaw is in the NSEC handling of that recursor. Applications that only use the library for authoritative serving or that do not validate DNSSEC can skip it, though they should still update the crate version.
Not affected if dnssec-validation-off, no-validating-recursor
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-proto and hickory-net versions in your Cargo.lock or dependency tree; affected if hickory-proto is through 0.26.0-alpha.1 or hickory-net is 0.26.0-beta.1.hickory-net and : move to or later.Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-proto0.26.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.